TrustFlow

• 

  07_governance_audit

• 

  03_governance_signoff_pending

• 

  02_employee_negotiation_s04

• 

  04_governance_signoff_approved

• 

  08_employee_s05_denied_advocate

• 

  09_employee_s02_wc_gate

• 

  01_glassbox_boardroom_s04

• 

  06_gateway_iban_block

• 

  05_gateway_email_masked

Inspiration

Enterprises want employees on AI tools, but the approval path is broken. IT, Legal, DPO, and — in Germany — the Betriebsrat (Works Council: elected worker representatives with a legal veto over workplace tools under §87 German labor law) trade email attachments for weeks while employees quietly paste company data into private ChatGPT. We collected a 55-item practitioner-evidence corpus; the single largest pain cluster (21/55) was the approval process itself, not the models.

The trigger insight: approval that takes weeks in the US can take months in Germany because of works-council co-determination. So we built for the hardest market — everywhere else is a subset.

What we're not: a multi-agent code-review tool, a software-planning agent swarm, or another IT ticket queue. TrustFlow governs which AI tools employees may use — negotiates stakeholder policy in an agent boardroom (structured multi-party debate), compiles it, and enforces it at the gateway on every inference.

What it does

TrustFlow turns multi-stakeholder AI-tool approval into a four-stage pipeline:

1. Agent boardroom (Qwen Cloud) — Stakeholder specialists debate with rebuttal rounds (not parallel monologues). Lanes match the org (demo cast: Procurement, Compliance, Works Council, IT, Runner). Each turn is schema-validated (stance, demands, concessions) before it reaches the compiler.
2. Policy compiler — Deterministic merge into rules.json + signed policy_version_hash, floor-checked against org red lines. LLM proposes; code signs.
3. Human sign-off — DPO + IT activate in parallel; gateway enforces the human-activated version only.
4. Edge gateway — Deterministic pre-flight: tool approval, works-council agreement status, PII scan, routing, budget — plain-English deny labels + EU AI Act Art. 50 audit events. LLM never runs at the edge.

Demo highlights:

• Payment routing approve path: Agents compromise on redacting payment-schema traffic through on-prem processing before completion in cloud → human sign-off → gateway activity audit (two chained audit events: redaction, then completion).
• Unsigned vendor DPA deny path: Procurement vetoes an unsigned OpenAI DPA (vendor data-processing agreement) → employee advocate + factual appeal.
• Glassbox (/glassbox) — transparent judge view: boardroom theater with live transcript and rebuttal rounds; click Gateway to test PII masking/blocking yourself. Scenario dropdown uses plain English (no S04/S05 labels).
• Gateway PII: email masked, IBAN hard-blocked at the edge (regex demo — honest scope).
• Works council gate: works-council agreement pending — the product tracks the gate; the legal process stays outside the software.

Track 3 — Agent Society (criteria mapping)

How we built it

• Qwen-Max via DashScope (OpenAI-compatible endpoint, dashscope-intl) drives every agent turn; each turn returns a structured envelope (stance, demands, concessions) that is zod-schema-validated before it enters the transcript — a malformed turn never reaches the compiler.
• Boardroom v2 debate orchestrator — opening statements, lane turns, rebuttals, and all-agent finals (15-turn cap); agents address each other, not isolated prompts.
• Deterministic compiler merges validated concessions into rules.json and signs a policy_version_hash. The LLM proposes; it never enforces.
• Recorded demo capture (npm run capture:golden) saves live qwen-max negotiations as replayable transcripts — the demo runs identically with or without an API key, and judges see Recorded demo badges in the UI.
• Hybrid deployment: the gateway runs in the customer VPC — data stays in the sovereign boundary; the boardroom runs on Qwen Cloud.
• Quality gates: 47 backend tests + 28 Playwright e2e across employee, governance, and glassbox surfaces.

Challenges we ran into

• Making agent output enforceable. Free-text debate is useless to a gateway. Schema-validated envelopes at every turn; compiler and gateway are deterministic — agents propose, code enforces.
• Real collaboration vs agent inflation. Boardroom v2 adds rebuttal beats so specialists respond to each other, not five isolated prompts glued by a summary.
• Demo determinism vs. live LLMs. Live negotiations word themselves differently every run. The recorded-demo pipeline saves real qwen-max runs and replays them deterministically, so the same system demos reliably offline and runs live with a key.
• Policy versioning semantics. A late bug taught us the gateway must enforce the human-activated policy version even after a newer draft is compiled — activation state has to survive recompiles. We fixed it with an active-version fallback and a regression test.
• Modeling co-determination honestly. The works-council agreement is a legal process, not an API. TrustFlow tracks and enforces its status as a gate (BETRIEBSVEREINBARUNG_PENDING) and leaves the negotiation itself where it belongs — outside the software.

Accomplishments that we're proud of

• A measured multi-agent win, not a claimed one: the same unsigned-DPA request through one generic qwen-max agent → conditional approve (unsigned DPA never surfaced); through the specialist boardroom → DENIED with vendor DPA pending in round 1. Live-captured, committed at docs/hackathon/baseline/, reproducible with npm run baseline:demo -- S05.
• A complete human sign-off loop — parallel DPO + IT sign-off, employee advocate, appeals that re-open the boardroom.
• Works-council co-determination as a first-class agent lane — a stakeholder no English-language tooling models.
• End-to-end honesty: every "illustrative" number labeled, PII scope stated, replay vs live visible in the UI.

What we learned

• Specialist decomposition beats a monolith on quality, not just speed — the baseline showed the monolith misses lane-specific gates entirely.
• Regulation is a design constraint, not paperwork: modeling §87 BetrVG changed the round schedule, the deny codes, and the audit schema.
• Put the deterministic boundary as early as possible: schema-validate at the agent turn, sign at the compiler, and the rest of the system can trust its inputs.

What's next for TrustFlow

• Pilot with a German mid-market fintech (design-partner conversations start from the DPO persona in our research corpus).
• Upgrade PII from regex demo to NER-grade detection in the gateway.
• Broader scenario coverage (HR, marketing content tools) and Betriebsvereinbarung workflow integrations.
• Harden the boardroom protocol: agent-count and round-count are config, so orgs can add lanes (e.g., InfoSec, external counsel).

Built With

• alibabacoudecs
• docker
• fastify
• node.js
• playwright
• qwencloud
• qwenmax
• react
• sqlite
• typescript
• vite